Executive brief
A race condition was identified in the Linux kernel's MCTP USB transport driver. This flaw could allow network operations to continue or restart unexpectedly even after the interface has been instructed to stop. While primarily a technical synchronization issue, such bugs can lead to system instability or unpredictable behavior in specialized networking environments.
Technical details
A race condition exists in `drivers/net/mctp/mctp-usb.c` between URB (USB Request Block) completion and the cancellation of `rx_retry` work during `ndo_stop`. Specifically, the sequencing between setting the `stopped` flag and calling `usb_kill_urb()` allowed a window where `mctp_usb_rx_queue` could be invoked and submit a new URB before the work was synchronized. This could result in the `rx_retry_work` being rescheduled after the driver intended to shut down. The fix introduces a new spinlock (`rx_lock`) to ensure that the `rx_stopped` state and work rescheduling are handled atomically. Patches have been backported to several stable kernel branches.
Affected products
- Linux Linux Kernel 6.15 to 6.18.36, 7.0.13
Timeline
- 2026-06-08: other: Patch authored
- 2026-07-19: disclosed: CVE published